Monitor for uncommanded braking

ABSTRACT

The monitor for uncommanded braking controls uncommanded brake application on one or more wheels during takeoff of an aircraft. Brake pedal application is determined, brake pressure is measured, and brake pressure is compared with a selected threshold brake pressure. A brake pressure applied signal is generated when the brake pressure exceeds the threshold brake pressure. The pedal application signal and brake pressure applied signal are received by a fault latch logic circuit that generates a fault latch output signal when uncommanded braking has occurred. A test inhibit signal is also generated when weight is not applied on the wheel. The test inhibit signal is also input to the fault latch logic circuit so that uncommanded braking can occur when the aircraft is in the air and weight is off the wheel. The monitor disables or latches off the shutoff valve when pressure is detected without pedal application. A fail-safe feature re-enables the shutoff valve to allow it to turn on, and monitoring is stopped, when pedal application is detected.

BACKGROUND OF THE INVENTION

1. Field of the Invention

This invention relates generally to deceleration control systems forvehicles, and more particularly concerns a monitor for controllinguncommanded braking of one or more wheels of an aircraft during takeoffthat also permits the use of a single microproprocessor to perform allbrake control functions.

2. Description of Related Art

Automatic braking systems have been commonly provided on commercialaircraft to aid the deceleration of the aircraft upon landing. As thesize and complexity of aircraft have increased, the automatic brakingsystems have also become more complex and computerized. Modern anti-skidsystems incorporated into aircraft braking systems commonly optimizebraking efficiency by adapting to runway conditions and other factorswhich affect braking in order to optimize deceleration, typicallycorresponding to the level of brake pressure selected by the pilot.

A catastrophic failure mode has been identified in one such conventionalsingle microproprocessor controlled brake-by-wire control system thatresults in uncommanded brake application on one or more wheels duringtakeoff of the aircraft. Since uncommanded braking during takeoff canhave serious consequences, and at the very least can result inunnecessary and accelerated wear to the braking system, it is desirableto configure the braking system to reduce the possibility of theseundesirable results. Conventional brake control systems having this typeof catastrophic failure mode typically require a second channel formonitoring and backup of the brake control system to prevent uncommandedbraking.

One conventional approach to overcoming the failure of the controlsystem has been the implementation of a multiple processormicrocontroller design utilizing D0178A level 1 or D0178B level Asoftware. However, the costs of implementing a multiple microprocessorcontroller design are significantly greater than that for a controlsystem utilizing a single microprocessor. It is highly desirable toprovide a monitor for uncommanded braking to prevent uncommanded brakingduring takeoff of an aircraft. It would also be desirable to providesuch a monitor for uncommanded braking that is implemented in hardwarerather than in software with multiple processors. The present inventionmeets these needs.

SUMMARY OF THE INVENTION

Briefly, and in general terms, the present invention provides for a newand improved monitor for uncommanded braking that also permits the useof a single microproprocessor controlled brake-by-wire control systemfor control of uncommanded brake application on one or more wheelsduring takeoff of an aircraft. The control system of the invention foruncommanded braking solves the problem of the catastrophic failure mode,so that a single microprocessor or microcontroller can be utilized toperform all brake control functions. The hardware monitor is easilyadaptable to most brake-by-wire designs. The costs of implementing thehardware monitor are tremendously less than that for a control systemutilizing dual microprocessors.

The monitor circuitry is implemented totally with hardware, using thesame inputs as are used by the brake system microcontroller, and doesnot rely on software to function. The hardware monitor disables orlatches off the shutoff valve when pressure is detected without pedalapplication. A fail-safe feature re-enables the shutoff valve to allowit to turn on, and monitoring is stopped, when pedal application isdetected.

The present invention provides for an apparatus for monitoringuncommanded braking for a vehicle having at least one wheel and a wheelbraking system with an operator operated brake pedal or the like forcontrolling braking pressure. The wheel braking system also includes ashut off valve that can be activated to prevent braking. The apparatusfor monitoring uncommanded braking comprises means for determining brakepedal application and for generating a pedal application signalindicating whether a brake pedal has been applied, means for measuringbrake pressure, and means for comparing the brake pressure with aselected threshold brake pressure. The means for comparing the brakepressure with the threshold generates a brake pressure applied signalwhen the brake pressure exceeds the threshold brake pressure. The pedalapplication signal and brake pressure applied signal are received by afault latch logic circuit that generates a fault latch output signalwhen uncommanded braking has occurred. Those skilled in the art willrecognize that, while the invention is discussed in the context of abrake pedal of the type used in an aircraft, the system may be used withany actuation apparatus designed to command braking of a vehicle.

In a presently preferred embodiment, means are provided for sensingweight on the wheel and for generating a test inhibit signal when weightis not applied on the wheel. The test inhibit signal is also input tothe fault latch logic circuit so that uncommanded braking can occur whenthe aircraft is in the air and weight is off the wheel. In a presentlypreferred embodiment, means are provided for testing functionality ofthe apparatus for monitoring uncommanded braking and for generating atest enable signal that is received by the fault latch logic circuit forresetting the fault latch to allow testing of the monitor apparatus witha test pressure pulse. Control means are preferably also provided forgenerating a shut off valve control signal, which is also received bythe fault latch logic circuit. In a currently preferred embodiment,means are provided for generating a shut off command signal to the shutoff valve that is generated only if the fault latch logic circuitgenerates an output fault latch signal and the control means generatesthe shut off valve control signal.

These and other aspects and advantages of the invention will becomeapparent from the following detailed description, and the accompanyingdrawing, which illustrate by way of example the features of theinvention.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a schematic diagram of the monitor for uncommanded brakingaccording to the principles of the invention.

DETAILED DESCRIPTION OF A PREFERRED EMBODIMENT

A potential catastrophic failure mode has been identified in a singlemicroproprocessor controlled aircraft brake-by-wire control system thatresults in uncommanded braking during takeoff. While implementation of asoftware controlled multiple processor microcontroller can be used toovercome the problem, the costs and complexity of doing so aresignificantly greater than for implementation of a single microprocessormicrocontroller with a monitor for uncommanded braking implemented inhardware.

As is illustrated in FIG. 1, the invention is embodied in a monitor foruncommanded braking 10 in a braking system for a vehicle, such as inbraking system including a brake-by-wire control system for an aircraft.The braking system preferably includes a shut off valve 12 that can beactivated to prevent braking. The braking system typically is controlledby a conventional braking microprocessor unit or microcontroller 14utilizing D0178A level 2 or D0178B level B software to perform allnormal brake control functions, and to provide a shut off valve controlsignal 16 when the microcontroller function is selected to preventbraking. The shut off valve control signal is received by a fault latchoutput AND gate 18, which also receives a fault latch output signal fromthe fault latch logic circuit 20 when uncommanded braking has beendetected. In order for the shut off valve to turn on, both the shut offcontrol signal from the microcontroller and the fault latch outputsignal from the fault latch logic circuit must be received by the faultlatch logical AND gate.

The monitor for uncommanded braking provides inputs to the fault latchlogic circuit for determination of a condition of undesirableuncommanded braking. A gear test inhibit logic circuit 22 is provided togenerate a test inhibit signal that is used to inhibit the hardwaremonitor in certain conditions. A pedal application circuit 24 isprovided for determining whether brake pedal application has occurred. Abrake pressure circuit 26 tests the left and right wheel brake pressuresfor a minimum threshold, and a built-in-test enable logic circuit 28tests the functionality of the monitor for uncommanded braking.

In a currently preferred embodiment, the gear test inhibit logic circuit22 is provided to generate a test inhibit signal that is used to inhibitthe hardware monitor for uncommanded braking when the aircraft is in"AIR" mode, i.e. when the aircraft wheels are no longer touching theground, when the gear handle is up and weight is off the wheels.Uncommanded braking that is not pilot or copilot generated can properlyoccur in this situation, during which time the hardware monitor wouldneed to be inhibited. When the gear is retracted, an application ofbraking pressure is typically performed at 200 psi for 4 seconds whileweight is off the wheel, and the gear handle transitions to "AIR" mode.Also, in gear extension testing, a pressure pulse test, braking commandsof 600 psi are delivered to the left and right brakes sequentially. Thistest occurs after a gear extension sequence, and the shut off valvewould turn on when the gear handle transitions to a down position, andthe "AIR" mode is off. When the gear handle transitions to down, atuneable timer set to typically 5 seconds, for example, is started.After the timer expires, the hardware monitor is enabled to monitoragain.

In order to avoid single point failure from stopping the hardwaremonitor from operating, such as from a failed gear handle switch, weighton wheel sensors, such as left weight on wheel switch 30 and rightweight on wheel switch 32, are used as a backup means for enabling thehardware monitor. The output signals from the weight on wheel switchesare received by OR gate 34, which operates to output a weight on wheelsignal 35 if weight is detected on any wheel. A gear handle positionswitch 36 also is provided to generate a gear handle up signal if thegear handle is in the "AIR" position. The gear test inhibit logiccircuit 38 receives the gear handle up signal, and receives the weighton wheel signal as a reset input 40. When weight on a wheel is detected,a tuneable timer (not shown) is started that is set to a desired delayperiod, typically approximately 8 seconds, for example. After the timerexpires, the hardware monitor is enabled to monitor again.

The gear test inhibit logic circuit generates a gear test inhibit signal42 provided as an input to the fault latch logic circuit. The logic forproviding the gear test inhibit signal is as follows:

Test Enable=Gear handle down+gear handle delay

Test Enable=Weight on wheel+weight-on-wheel delay

Test Inhibit=Gear handle up and weight off wheels

The monitor for uncommanded braking preferably also includes a pedalapplication circuit 24. Pedal position for the right and left brakepedals is measured with a sensor, such as a linear variable-differentialtransformer (LVDT) having an armature connected to the pedal that moveslinearly inside first (HI) and second (LO) coils, so that movement ofthe armature inside the coils of the differential transformer changesthe inductances of the coils. Pedal position can thus be obtained bydetermining the difference between the LVDT coil A (HI) and LVDT coil A(LO) signals.

Position=LVDT coil (HI)-LVDT coil (LO)

A test LVDT signal is determined by summing the LVDT coil A (HI) andLVDT coil A (LO) signals.

Test=LVDT coil (HI)+LVDT coil (LO)

With reference to FIG. 1, the position of the pilot's left brake pedalis thus provided by the pilot left LVDT coil A (HI) 44 and the pilotleft LVDT coil A (LO) 46, while the position of the pilot's right brakepedal is provided by the pilot right LVDT coil B (HI) 48 and the pilotright LVDT coil B (LO) 50. Similarly, the position of the copilot's leftbrake pedal is thus provided by the copilot left LVDT coil A (HI) 54 andthe copilot left LVDT coil A (LO) 56, while the position of the pilot'sright brake pedal is provided by the copilot right LVDT coil B (HI) 58and the copilot right LVDT coil B (LO) 60.

A Pilot/Copilot select signal 62 can be used by the monitor circuit toselect between demodulation of the pilot and copilot pedal position andtest signals. The signals from the pilot left and right LVDT coils arereceived by the pilot pedal position and test signal circuit 64, whilethe signals from the copilot left and right LVDT coils are received bythe copilot pedal position and test signal circuit 66. The pilot andcopilot pedal position and test signal circuits provide outputs of theleft and right pilot and copilot pedal positions, respectively, to thepedal position comparator circuit 68, which selects the highest of thepilot and copilot LVDT values, which is in turn output to the pedalapplied comparator circuit 70. The highest of the pilot and copilot leftpedal position LVDT values is selected to determine the left pedalposition, and the highest of the pilot and copilot right pedal positionLVDT values is selected to determine the right pedal position. Thedetermination of whether a pedal has been applied is made by the pedalapplied comparator circuit 70, by comparing pedal position values with athreshold value 71, which is typically set to a value that isapproximately 5% of the maximum pedal position value, although othersimilar threshold values may also be suitable. When a pedal isdetermined to have been applied, a pedal applied signal 72 is providedby the pedal applied comparator circuit as one input to a fault latchlogic circuit. The test signals are used to check each pedal LVDT forintegrity, by checking the minimum and maximum limits of the testsignals. If the test signal falls outside predefined limits, thendemodulation of the particular pedal LVDT is discontinued, and the pedalposition is zeroed.

The hardware monitor also preferably includes a brake pressure circuit26 that tests the left and right wheel brake pressures for a minimumthreshold. The brake pressure circuit includes a left brake pressuredetector 74 whose signal output is received by a signal filter 76 forfiltering spurious pressure spikes, and a right brake pressure detector78 whose output is received by a signal filter 80. The filtered pressuresignals from the left and right brakes are received by pressure signalcomparators 82 and 84, respectively, for comparison with a selectedminimum threshold value from reference pressure signal source 86. Theoutputs of the pressure signal comparators is received by OR gate 88,such that a pressure detection signal 90 is generated if either the leftor right brake pressure is greater than the selected minimum threshold,which is typically about 300 psi, for example, although other similarthreshold values may be suitable. The test inhibit signal, the pedalapplied signal, and the pressure detection signal are provided inputs tothe fault latch AND gate 92 of the fault latch logic circuit.

The fault latch logic latches an uncommanded pressure condition.Uncommanded pressure is determined by a logical AND of the pedalreleased signal, pressure detection signal, and test enable signalsinput to the fault latch logic circuit, requiring all three inputsignals to result in a fault latch, as follows:

Fault Latch=Pedal Released+Pressure Detected+Test Enable

A latched fault can be reset by brake pedal application, or by ahardware monitor built-in test sequence, which is a fail-safe featureexplained further below, built into the circuitry that can reset thefault latch, stop the operation of the monitor, and allow the shut offvalve to turn on.

The functionality of the hardware monitor is tested at power-up by abuilt-in test enable circuit 28 at a safe time to do so, such as whenthere is no wheel speed and no reference velocity present. A hybrid LVDTis set to loopback to provide an LVDT loopback input signal 96 to thebuilt-in test enable circuit. A simulated brake pressure test pulse 97is also generated and input to the right and left brake pressure filtersand to the built-in test enable circuit. The built-in test enablecircuit in response produces a test enable signal 99 to the fault latchOR gate 98, which also receives the pedal position input 100. The outputof the fault latch AND gate 92 of the fault latch logic circuit isreceived by the fault latch 102, which can be reset by input from thefault latch OR gate 98 to the fault latch reset 104. The fault latchoutput 106 of the fault latch 102 is received by the fault latch outputAND gate 18, which in turn produces the shut off valve command signal.

The built-in-test sequence of the monitor for uncontrolled braking hasthe following logic:

1. Ensure no pedal application (i.e., be in monitor mode).

2. Apply a simulated pressure test pulse to simulate uncommandedpressure.

3. Verify that the shut off valve is turned off.

4. Reset the fault latch, and allow the shut off valve to turn on.

In order to insure that there is no pedal application, the pedal faultdetection circuitry is used to ensure that the pedals are released. Thelogic is as follows:

1. Set the LVDT circuitry in loopback mode.

2. Pedal LVDT fault is detected by the hardware monitor.

3. Pedal demodulation is stopped by the hardware monitor.

4. Sample and hold capacitors are discharged and zero pedal position isachieved.

5. The hardware monitor is set to Pedal Released mode.

After the Pedal Released condition is detected at test point A (notshown), the simulated pressure pulse is injected. The shut off valvewill turn off in a predetermined period of time, such as 200 ms, forexample. When the shutoff valve is determined to be off, the pressuretest pulse is removed. The LVDT hybrid is then taken out of loopbackmode where the same sequence will reset the fault latch. The resetsignal to the fault latch is capacitive coupled to avoid failureskeeping the output stage (fault latch) in reset condition. If thehardware monitor built-in-test logic fails, and tries to reset the faultlatch continuously, the capacitive coupling only allows a momentarypulse, thereby avoiding a continuous reset condition.

It will be apparent from the foregoing that while particular forms ofthe invention have been illustrated and described, various modificationscan be made without departing from the spirit and scope of theinvention. Accordingly, it is not intended that the invention belimited, except as by the appended claims.

What is claimed is:
 1. Apparatus for monitoring uncommanded braking fora vehicle having a wheel and a hydraulically operated wheel brakingsystem with a brake pedal for controlling operation of said wheelbraking system and a shut off valve for preventing communication ofbrake pressure to prevent braking by said wheel braking system,comprising:means for determining brake pedal application and forgenerating a pedal application signal indicating whether said brakepedal has been applied; means for measuring brake pressure; means forcomparing said brake pressure with a selected threshold brake pressureand for generating a brake pressure signal when said brake pressureexceeds said threshold brake pressure; fault latch means for receivingsaid pedal application signal and said brake pressure signal, and forgenerating a fault latch output signal for controlling said shut offvalve responsive to said pedal application signal and said brakepressure signal; and means for sensing weight on said wheel and forgenerating a test inhibit signal when weight is not applied on saidwheel.
 2. Apparatus for monitoring uncommanded braking for a vehiclehaving a wheel and a hydraulically operated wheel braking system with abrake pedal for controlling operation of said wheel braking system and ashut off valve for preventing communication of brake pressure to preventbraking by said wheel braking system, comprising:means for determiningbrake pedal application and for generating a pedal application signalindicating whether said brake pedal has been applied; means formeasuring brake pressure; means for comparing said brake pressure with aselected threshold brake pressure and for generating a brake pressuresignal when said brake pressure exceeds said threshold brake pressure;control means for generating a shut off valve control signal; faultlatch means for receiving said pedal application signal and said brakepressure signal, and for generating a fault latch output signal forcontrolling said shut off valve responsive to said pedal applicationsignal and said brake pressure signal; means for generating a shut offcommand signal to said shut off valve responsive to said shut off valvecontrol signal and said fault latch output signal; and means for sensingweight on said wheel and for generating a test inhibit signal whenweight is not applied on said wheel.
 3. A method for monitoringuncommanded braking for a vehicle having a wheel and a hydraulicallyoperated wheel braking system with a brake pedal for controllingoperation of said wheel braking system and a shut off valve forpreventing communication of brake pressure to prevent braking by saidwheel braking system, the steps of the method comprising:determiningbrake pedal application and generating a pedal application signalindicating whether said brake pedal has been applied; measuring brakepressure; comparing said brake pressure with a selected threshold brakepressure and generating a brake pressure signal when said brake pressureexceeds said threshold brake pressure; generating a fault latch outputsignal for controlling said shut off valve responsive to said pedalapplication signal and said brake pressure signal; sensing weight onsaid wheel; and generating a test inhibit signal when weight is notapplied on said wheel.